Is there a reason why session storage isn't local, with clients only given the index into that storage? Allows for any size/types of data but the worst case sc

Is there a reason why session storage isn't local, with clients only given the index into that storage? Allows for any size/types of data but the worst case scenario-without code execution is that an attacker hijacks an existing but valid session.